From: Hugh Sasse Staff Elec Eng <hgs@...>
Date: 2003-08-26T22:51:54+09:00
Subject: Re: Email and smtp.sendmail security vulnerabilities?

On Tue, 26 Aug 2003, John W. Long wrote:

> Hi,
>
>
> Well, at any one time I do not intend to allow the user to enter all of the
> information. Right now we have an "email this page" form on our web site.
        [...]
>     http://iblp.org/email.asp
        [...]

This is open to the same kind of abuse.
>
>
> While I realize that anyone with enough know how could send mail from the

But it isn't much know how: it is only constructing a URL.  Then the
"spam" comes via your domain, and you get blacklisted.

> form, he would have to be willing to send the message with our header and
> footer (something I hope would discourage spammers from using our form).

Spammers don't seem to care much how their message is delivered.
This statement is anecdotal, of course. Add a tablespoon or 4 of
salt, to taste.

>
> The main thing I want to know is if someone could enter a message that would
> add headers to the email or cause the footer not to be displayed, or exploit
> some other security vulnerability. Right now I'm preventing the email fields

I've not looked in that much depth.  I think this is a serious
enough flaw to make that much less significant.

Another quick look throws up:  You have not trapped ';' although you
don't pass this directly to a shell, so you should be OK.
When you expand the string with #{} they can find out things like
$RUBY_PLATFORM and such, which may reveal more about your system
than you wish to reveal.

The Body cannot become part of the headers, even with vertical tabs,
I think.

The Message id may not be unique, since you only use time.current.
You may need $$ and possibly Thread.current as well to guarantee 2
concurrent submissions having unique ids.

I don't seem to have enough low cunning to think of all the holes
that others are able to point out.

You also may wish to limit submissions from/to an address in a given
period to prevent automated mail bombing.

> from having more than one address, and am forcing the name fields to only
> have certian characters. The field that I am primarily worried about is the
> message field.
>
> --
> John Long
> http://wiseheartdesign.com
>
        Hugh